Digital Forensics and Incident Response - Second Edition

The digital forensics process

Much like the incident response process, the digital forensics process defines the flow of digital evidence related to an incident, from when it is first identified to when it is presented to either senior leadership or to a trier of fact, such as a civil or criminal court. There are several schemas that define this process and, for the most part, they generally follow a similar path. Here, we will be utilizing the Digital Forensics Research Workshop (DFRWS) digital investigation framework. This framework is depicted in the following diagram:

The framework contains six elements:

• Identification
• Preservation